Extract todo and visor models behind shared Rust history access

[lannbot]

Summary

• Extract todo-model and visor-model Rust crates for domain schema and operations.
• Share the document-history Automerge adapter and engine's schema-neutral Rust document access/publication interface between both consumers.
• Keep one authoritative live document per partition in engine; kernel composes model operations and schedules browser checkpoints.
• Remove engine's task/visor schema methods and production model dependencies. Plaintext membership/bootstrap remains in engine.
• Publish every transaction authored by a model callback, including committed transactions preceding a domain error; document this partial-commit behavior and the distinction between engine acceptance and browser durability.
• No new WIT, component isolation, migration, or compatibility layer. This is a trusted in-process refactor.

Verification

• Astra review complete.
• Formatting, Clippy, Deno checks, WIT validation, native tests and all 31 Chromium scenarios passed.
• Model tests cover task CRUD/order and visor field patches/clearing/get-or-create.
• Engine regression covers multiple transactions, peer sync, reload, and a committed transaction followed by a domain error.
• Rustdoc for all three extracted crates passed without warnings.
• Engine normal dependency tree includes document-history and neither model crate; models appear only as engine dev dependencies.

Automerge will be armed.